Nintendo Faces $2 Million Ransom Demand After Alleged Theft of Decade-Long HR Data

On 28 January 2026, a hacker using the alias ShadowByte$ (also SHADOWBYT3$) posted on a cybercrime forum that it had exfiltrated roughly 859 MB of Nintendo data and demanded $2 million to prevent its release or sale. The material reportedly includes employee names, corporate emails, HR surveys, workplace-feedback forms, internal analytics, performance metrics, planning documents, and financial PDFs such as bank statements and W-9 forms.

Hacker claims to have stolen Nintendo employee data and more (UPDATE)

Nintendo has previously suffered high-profile breaches, notably the 2020 “gigaleak” of legacy console data and a 2023 intrusion linked to the Crimson Collective. The claim reflects a broader trend of attackers targeting third-party HR platforms for double-extortion, as seen in recent Lapsus$-style operations.

Nintendo Hacked Again? Attacker Demands $2 Million Ransom for Return of Stolen Data

The alleged perpetrator, ShadowByte$, emerged in February 2026 and previously claimed to have accessed Starbucks AWS data. Nintendo Co., Japanese game developer, has not commented. The hacker cites TinyPulse, a cloud-based employee-engagement service, as the likely compromised vendor; TinyPulse has not responded.

Hacker claims to have stolen Nintendo employee data and more (UPDATE)

Analysts who examined the leak identified records from 2016 onward. Verified items include real names and corporate emails of current staff, pulse-survey responses, analytics, performance metrics, planning documents, and financial forms such as bank statements and W-9 PDFs. File metadata shows a creation date of 28 January 2026, indicating recent extraction.

Threat actor demands $2 million from Nintendo, claims theft of decade of corporate data

Nintendo has remained silent, neither confirming nor denying the breach. TinyPulse also declined comment. Firm Cybernews said the samples appear authentic and match active Nintendo employees.

Nintendo breached: Attacker demands small potatoes

Security experts warn that reliance on third-party SaaS providers creates a point of failure. Mitigations include vendor audits, mandatory multi-factor authentication, least-privilege access, and monitoring for large data exports. Law-enforcement advisories caution that paying ransoms does not guarantee data deletion and advise against compliance.

Hackers demand $2 million ransom from Nintendo

Cybernews finds the leak plausible but no independent verification exists. It remains unclear whether the intrusion originated from Nintendo’s network or a supply-chain breach of TinyPulse. The full extent of compromised files beyond the 859 MB sample has not been disclosed.

Nintendo breached: Attacker demands small potatoes

• “The sample contains HR data, such as pulse surveys and questionnaires about how employees are feeling at work,” — Cybernews researcher

Threat actor demands $2 million from Nintendo, claims theft of decade of corporate data

• “Some people from those pulse surveys are still at Nintendo and were identifiable, so the leak could be legitimate,” — Cybernews researcher

Threat actor demands $2 million from Nintendo, claims theft of decade of corporate data

• “If the payment is not made, the attacker has threatened to either release the data publicly or sell it to the highest bidder.” — SHADOWBYT3$

Nintendo Hacked Again? Attacker Demands $2 Million Ransom for Return of Stolen Data

• “Law enforcement agencies frequently warn that there is no guarantee they will actually delete the data they have stolen, and the advice – as ever – is not to pay.” — Law-enforcement advisory

Nintendo breached: Attacker demands small potatoes

Cybersecurity firms advise Nintendo and peers to adopt zero-trust architectures, deploy data-loss-prevention tools, and run regular incident-response drills for third-party compromise. Monitoring anomalous SaaS export activity will be critical as the situation develops.

Hackers demand $2 million ransom from Nintendo